3a1d664b4e20a716d39657bd8b7b524d256b25e3544f30fa7b568aadd16dbc8e

Sharing

Copy URL Twitter E-mail

General

Target
K+_Global_21.26.4.406.0.22.0.7z
Size 453.1MB
Sample260819-fg66gsdq3y
SHA256 3a1d664b4e20a716d39657bd8b7b524d256b25e3544f30fa7b568aadd16dbc8e
MD5 aea84c9bd7fc81c1e75c0753eba66adf
SHA1 a9c9ae6750727d3f5c8314993567b3eff6aadb04
SHA512 8e8401b87a65cb352fc4696f3a8743e8889a7cc5d94aea10421b847edc6702584ad00584c65412f38eaf0a70f43bfd2b025065e41fa58b1b7b1ef8676de914fa
SSDEEP 12582912:c3rThlZ9p5nN9EVlYpowk8ByISzdIMLO4L6nwL40g:ch9Y2pmkSz6MLonwL40g
TLSH
T1203933725828F77EC01DA3BD9D93B624388AD76D481EF603B38DA6F301D12961DFA941
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  K+_Global_21.26.4.406.0.22.0/Kaspersky.exe
- Size 462KB
- SHA256 81ff46bdeca15adead0c497a2e05835d7ff3912a60cdcb5d90d204ecfbfad7a4
- MD5 89a62d5a6f43d74cdfd828f9fc8278cf
- SHA1 50c1fc0e76330693ba465d5f94e7b23cc7962d8d
- SHA512 d385b7f0d6e0ad6af8e18aab08968f3d3218e92efe3f218e9563bd96e13af10decb9468b8a2664e5695e93e060499d928c9b8fbf699c985221fb068ca5bf3ed6
- SSDEEP 1536:SrPJVKjbcknWSOYvTfkWkFM79yQVyaTd/TsToWk8kckck8k8pckdkkMkcukQ8kcK:SLJMjbcHDdMwQTTxTsE
- TLSH
  T16AA465AB741ACA52DC006872CD96D4FE7274BD60DDA558A330EE7F3FB838D548A0512E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  K+_Global_21.26.4.406.0.22.0/Startup.exe
- Size 6.7MB
- SHA256 242990d9aad37f9d78b9a695b5401cdc39055098fcf9e0a32a8490b0a34bcedb
- MD5 6ffc667a1f59526e972ab836fd149b37
- SHA1 7c099e99884ea5556506d20f6502d07feca07dcc
- SHA512 0bf0fee6081ac17360fcedf7104a7e0b1d7fd66c9188926612b059f63764f7fbc5a09051c3c50e40ce9a9a0f3f4b3c91c1c254daef3d89a530ce4f15af2a0fed
- SSDEEP 98304:+OTfcPgU2vv161ErDOs3RXJgylx6JGIdRHtQ+gbBQo7NsusF1tm6EsX:Zc4UgUe3OsBvulQP3susF1tm67
- TLSH
  T1ED66F0216E3D9121F422853C196DA677D5BBBBECBB1F418B62B4263B1B63780052D373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks for any installed AV software in registry
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  K+_Global_21.26.4.406.0.22.0/bases.pack
- Size 161.1MB
- SHA256 ab85191c4802afb99a433f42c7544d073f82ffbdbc0b42e04f5dc75e0a5c6179
- MD5 306531bab5dde22bf7a6e8700764c66d
- SHA1 9517a61019aa830990adc6f5ec776dea436997a2
- SHA512 96f949b0cd2c46f3b563d48cfe7ca4da7f6a1234ccadcc583509d129e96cd0b9696ecf1b338d26349daa8bce76d2619e18f5e022a860b9f55c9ef5b9d7ae269a
- SSDEEP 3145728:1kZJw0H9yKHXlaSenIslG57ucKJBbaQ7zeWbOs9CMesJxInGYepo8PwxEjU:1kZ2alaSenblA7NKJhXawTItepocwEjU
- TLSH
  T10B8833B268B096AF842DB31C7C90B71C76D07322DDAEAA35725D7AE7C6C11E24975CC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  apuhttps.dll
- Size 322KB
- SHA256 f5662aaef0c6c0bc94aecb6624d42c6724dffa6fc2a93970dcc4abaa9c6110d0
- MD5 5de8e3ff57e202cc4a26db64e51e75d1
- SHA1 cb03434c091bbda0843b140e6488c0dd31192b12
- SHA512 1ad65a8e855647e8dce618aa3bc94afd11c8ae737c64d78709e8418f3480a8bfa39ddb0275e83a6810d40918f3c693228bbc7984a8c936fa249ac62ef0413242
- SSDEEP 6144:KB/+5/H4R3Cr0rCuA0tslz4vCCAOkE84L8scBnwU3J:KZ+5UCrkCuAiUCawcBnwU5
- TLSH
  T16264AE107682C472D9FF05B0687DDB6A46BC79214B60C8E7F7D84E1D0F722C29A71A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Bases/APSIG/log0
- Size 7.4MB
- SHA256 866ef7af3e557a3f9195284dade3155707c7315e131ed8c4ecb4cbffb38c2a6d
- MD5 8d771d4c488c338c7b12b1c50c1e1fd3
- SHA1 bc045f882626ce3df819cd40f30fd469f5659599
- SHA512 587cf4f5edbe97ee5c5e84c3519bc45bc5dd80ef9a1a72048c41939e034fa2a8579373469934f01f217ee8e7d7b02ed3aab8715ffe66901e6ac27c328fb6b655
- SSDEEP 98304:pwPZD+TbKzPH+8LJWfqjQfmAcE0E0jrwU1ZflXK2H6UjgGPWusp0:ppVqjQfa3EGrzaW5up
- TLSH
  T13A7602133A93C135DC6D1170E839B76E44AD6AE40B6464CB32AC5F5EED320D21A36ADF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Bases/APU/log0
- Size 4.2MB
- SHA256 d89b7e2e7cba069b37d1e7f4c40d35492872cccc4d447296c6f21cb6ee36e02e
- MD5 04c31581141170a2a3cc5f4067ff673e
- SHA1 2811c6ca3007bed53ecbdb7586e0b20b0166bdf7
- SHA512 0ef26268dd532f90680fb655b67b07a3c69272111358946b4b034bf121933a019efd9db556d1ae612190f492358b2053624a6183efcc78d74fd7b06fe5497035
- SSDEEP 98304:IkqqwddR8FXlGJzauOEm+LUArsfLt/cYYcOxREqybqCq:S1dG/UWuW+LxrsfFH51qyb
- TLSH
  T11626334CF73A2F08CA49293A63ED0609CB69932D11F44FB374AD9C95CBA5B101B7796C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Bases/BB/log0
- Size 340KB
- SHA256 c615dd99365d78056ffa3a7b89c081c93b91cc8a2492df6846ba692a33a75d49
- MD5 baffe6d1fcde0765e99f4b904239bf42
- SHA1 3586a1e9150aa276f7a5c36f01cf04a84caa7092
- SHA512 084c915e28b333a5bad2713745a75309139523a8f460c4ecedaadc780733ac2fc923828c47f10c2274d92ca7f208ce44113d097ebba4015b13338c3d5ffc1f43
- SSDEEP 6144:BTprvt72TpCLOuw6UALHlEo/4BSADcWF:BT1G65aowBSA
- TLSH
  T13C74E050B72ED637D0E1223325C61BA1377FA185A472930B7C8CEA134FA7B48C1AB795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Bases/ICTRL/log0
- Size 726KB
- SHA256 5487850c5f44b3ce39c7da21da7bd8eef280b91671cd4323dbc37e7d8c812023
- MD5 73ac126a120f1dc11182c4aa5c263504
- SHA1 4432385f5f51bbdcf9356281db53f628edeee067
- SHA512 8d9ed4b093e27dadf3f8df4e26204cfebf9cf5cf010d4fca5977cd64c1050f2da5982821dd14a6ec0f058fa0347ceb383b1f03fb7efeb594d353f830b4302b2d
- SSDEEP 12288:SAKEz98hltOlJcHa9VR12+TCJhJtd93xBcf0Fcihgk+otnH7OL7x6QB:r7qhltv6mWg6cFthj+oJOLF6Q
- TLSH
  T1FEF48B31F941C439E99A05B1AA7D6E7E187C7764077844D77B8C4CB89EB04C32B3AA87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Bases/SW2/log0
- Size 12.9MB
- SHA256 78910c0d52022d642531fcadfd88b6c073d64c73ea7aeef8b7a59046aa16d149
- MD5 cb12546d42e8941229b141f3ffc42d5a
- SHA1 a1e1fd0afdf06af7ad5f2081749aab13048a0218
- SHA512 25be26ea3ee9cb7364f94f163c0db9494da7174a3178ee57aa1c48377599305e7bbc9a45fad1a4c435555856da778950641dfa3ade3709b73eff7c3e5c2b43e0
- SSDEEP 196608:TEpsdejWB/BHr5Za8NfAMkbawXtPKBrdYyUXO0O71TeDlMnq91mnY4:7dbBpr51CMPwlKBrdYyq7O5craY
- TLSH
  T11CD6E0237B50C039EA6F42B11C7AF358456AF6701EB542A7B794570EBF740C2AB2E613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Bases/UBI/log0
- Size 80KB
- SHA256 9e5f656607c9af7cabe4fd5d16026834047e7ee79ce0d3e778bf513e5d1fb788
- MD5 87a60a33eaebcaa2bf16a22d486b05df
- SHA1 faf008e89593f30055248e415809e9c7cb665c0f
- SHA512 27ee503fa70ba9cff99652c92c350ad706aa3f5859a33b15f71ab50166325ef048c7d6cafc0b452c4d2110a6a0ed2d561770ec83432f074fb5e7ba3189ea51f6
- SSDEEP 768:3AzWfvvcBUxXZvso8kfVZik82qKQExhYnHM4a9xgB:3AzW3XXRlZiJ2tYHML9xg
- TLSH
  T1AB83BF874B05F90DC291EA3848F86D9E9E23B3480BF49643355E881D17EB752CA63F9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Bases/UMIDS/log0
- Size 2.4MB
- SHA256 9fe9257241c811867cd9edf35240f6afac32a8d7be1f6684de85535c36255bc3
- MD5 91d79cf6725d295182df6eec4213b7f9
- SHA1 5596345edaf769490ae59bb56a66ec8cc146430f
- SHA512 bbded6e6316b5063cb1b79ea8ca03a0e284c9ac26eb47d41194b26f58cbaa57ae2c27d427c6100c4a0ee6c18aed3b3a6db55c8fd66272a683c116e4917135981
- SSDEEP 49152:1WIe+wMYEu5WNGyTl3pvkC7hQAbzoD8TCMRBZn2Ay0Iay7niWl5xqWQz0J:EITxDu5ByppcC7htb0wTCMRBZ/y0U7mI
- TLSH
  T14BC51232FD01C066EADA41F2E2BD2E7E0C3D9B18036990D76B985CA457B05D37A39B47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Bases/VSP/log0
- Size 64KB
- SHA256 c9806dfa45550e0264a66c1765eebbdb14c7acdb9b5e5238c48539c18fd2ae0a
- MD5 b5899344ca5f3520a82843110f06ec81
- SHA1 0d2caa96c6d90a82e0043d74bc1d0c95e578b16d
- SHA512 2be936205572e0509be662cf94c678e8f7d7d71bf4d81f794a09f89d89725fa22bce97b473ed60be6120f029bb6f39bf6236ac6298d94bfe6f6017b96e6d044f
- SSDEEP 192:0ZaVYlvCWKWDwzi+jvuaAbo/q6DP6sDcXB:uEYZCWKBzNjvjCoS6
- TLSH
  T1EF53F7852F08AA05E689DA344ABABC170FB3B3D109B1932B361DCC4B4BC7755DD02B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Bases/WCC/log0
- Size 9.5MB
- SHA256 089ead60486121c79b87874f8344ac1a8f3a23fc8490a667a27afa2a25b90e03
- MD5 dd0f447d3a231b2a2df8204cc2e9965f
- SHA1 39a9c4ebf1279c8777c0a4cbbe6a9ff9f4ab6a10
- SHA512 f6a6a528a9062757d8512fb4b9893d8ac35dda4c9eab06b46632ffb87abeb6f464fe2f4a890f83c39fb5c3f7964aeea4243eec0c494cebfb459d187ab817ae42
- SSDEEP 98304:Npx1RGR1TT2GQnPaNKPG1QdgJa1Jhx8AdV4atBrnU8l7LVWA2VFMMCkwaIkGzy3M:7x1RGbGKJSJLrLJM7FqQGzymZTwxw
- TLSH
  T121A61210B7C2C437FE851532D5BEEA57863CE219136161EF36882871DE30AE367B9297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Bases/WEBAV/log0
- Size 82KB
- SHA256 9ab5b910bc019835fb9525e1549d5745e6a88927f0ff4a54b130e9158860320d
- MD5 fa770f693e03f10b58f9077ed66b51a6
- SHA1 4066c81e95d1e906055b939e72b7e98d29228d4c
- SHA512 129b1a250877f1f052ace45f3eda9bbecbebbbd99f3e36a087b616cd0d2a4fabd3868cd62e27c18f369eef54c557fab730aa9afbcdbb7ca1f85dd61ae1217808
- SSDEEP 384:OXnUS6DV3M3wxH8APC8cL4k/SKijuHdqlXB8e4ayiGB3v6meLLhItajD66pvvc:OEGwBta8A4k6jYdhMcyf0GD6Qvvc
- TLSH
  T10C83D0D917146E48E2C8F970057F7C2F0F2363CB49F28217315E688A97977A86D1276E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Bases/WFD/log0
- Size 5.1MB
- SHA256 c900efa66ad73f71763e815644e311284635971f2e3809bd350609e4810e011f
- MD5 6f602065cbdfc9bf4ffb25275da91b88
- SHA1 915fda14c4dd72bbdacb6cceadc7a3be70b634eb
- SHA512 fe5c94c8fb59772de2e84b5c2e1a46900ba3ff317e361649824c5db752f461910042f08d724ead0d8b0f36275d9c193492fb766dd8a25b481d04a295725782ae
- SSDEEP 49152:gwO0tXpXGHJguZbxit5EHR1x0l9szPW393jC7PnYeC+6hT1Q97I:cZJgyxp0l
- TLSH
  T1F736FFE906B052A1F7DCA672AF35DE9D421A71E19DB02CD66E9F7E8C0C55F804F78820
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Bases/WMUF/log0
- Size 2.5MB
- SHA256 2cd95dfd8ec5e2e1876663e1112e54f010b4183684517d0bf59d0e3f63811527
- MD5 caf38b8eea39a4269dcef799a2a34891
- SHA1 3a9b79aee969fe002b5334958ece9b036020a734
- SHA512 2fa7f481926d4df1c523ce5fc45812d2ff2fd62694a3a212885ab93e06f7796229ceb0034b4d42be4429fa347a448aa53118202288b60da45b8db5959a4502a9
- SSDEEP 49152:BWtEV35/1cmWXZzKsfZ8f5GGvrnfi5qSkZeBWr/rq8EelsDXDw3s:B023fc3NKsKk+bfGqSkesG8BeDw3
- TLSH
  T125C52350C32BB71FEB06997D748AAC15450F3E2AB272860E3C7E79E7E7B5A011B1095C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Checks for any installed AV software in registry

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32